certificate problems with RDP within a SSLVPN? (Portal not Tunnel Mode)

[Sylvia]

Hello, has anybody experienced any certificate problems with RDP sessions within a SSLVPN portal? Regards, Sylvia

[Kess]

Yes, in fact it' s normal because using the portal, the RDP client connects to 127.0.0.1:someport The certificate present on the server is signed in order to be called using the server name and not an IP address or the localhost address. I can' t see any solution to that problem at present. BTW Fortinet is not the only one using this technique in order to connect to remote ressources using a SSLVPN portal.

[Sylvia]

Hi Kess, yes, that' s true. My problem is, that there is one client (Windows Vista) will get the certificate error but cannot continue. Even though he accepts the error message. The RDP session still doesn' t start... Regards, Sylvia

[Kess]

Sorry if I reply so late... Well, if you have other working machines it means that your FG settings are working. In that case the problem relies on your vista desktop. At present I can only see just one place where to change something, the mstsc.exe settings. On your Vista PC execute your client (mstsc.exe), click on " options" , choose the " Advanced" tab and have a look at the " Server Authentication" section. There you' ll probably find your " wrong" setup. Let me know

[Sylvia]

Hi Kess, thanks for your reply. But we are not talking about the tunnel mode, so the local mstsc.exe of the client shouldn' t be involved. Regards, Sylvia

[Kess]

In fact it' s not like this. I tested it in this moment, when you click on that RDP Bookmark it calls up the Native Windows RDP client. You can easily check this by monitoring your active processes... You' ll see a new mstsc.exe showing up when you click on your RDP Bookmark. This is also the reason because RDP bookmarks are not showed up in the iPhone Fortinet SSLVPN Client. So, to resolve your problem, please check what I wrote in my other post. Modify your " Default.rdp" of this windows client and you' ll see everything working perfectly. Hope it helps. Bye Kess.